Skip to main content
Every form is checked against a honeypot: a decoy field that people never see but simple bots tend to fill in. Those submissions are dropped without telling the bot what went wrong. A Hosted form adds the decoy for you. On an Endpoint form you add it to your own markup, as shown in Files and CAPTCHA. For stronger protection, turn on CAPTCHA under Security in the form’s Settings.

​
Choose how to run it

Open the Captcha provider menu. What you see depends on the form:
  • SurveyOwl protection (hCaptcha) is free and needs no keys. Picking it turns CAPTCHA on, and respondents see an hCaptcha checkbox on the last page. It’s offered on Hosted forms when your deployment has it enabled.
  • Your own provider: reCAPTCHA v2, reCAPTCHA v3, hCaptcha or Cloudflare Turnstile. You use your own account, so your quota and risk scores are the ones that count. This is the only choice for an Endpoint form.

​
Use your own provider

1

Pick the provider

Choose it from the menu. The settings link to that provider’s console.
2

Create keys

In the provider’s console, register every hostname the form runs on. Include localhost if you test there.
3

Paste both keys

The site key is public. The secret key is stored securely and is never shown again after you save. Once both are filled in, CAPTCHA switches on.
4

Set a score if it's score-based

For reCAPTCHA v3, a higher minimum is stricter. 0.5 is a sensible starting point.
5

Save and test

Save, submit a real response, and check that it reaches your inbox.
The CAPTCHA switch pauses and resumes whichever option you picked without losing your keys. On a Hosted form, SurveyOwl shows the challenge for you. On an Endpoint form you render the provider’s widget yourself and send its token along with the answers. See Files and CAPTCHA.
Keep the secret key private. Never put it in page HTML, a public repository or a support screenshot.